The MD5 sum for WinSCP2.exe refers to separately downloadable executable, not to the file installed by installation file. Separately downloadable file is compressed by runtime compression (UPX), while the installed file is not (because installation file is already compressed).

---

(This is not longer true as of 2025, the runtime compression is not used anymore and all executable files are the same).

First of all, kudos and congratulations on a fine piece of software. :D

When checking the md5sum for the installation file (winscp230setup.exe) and the executable (WinSCP2.exe) which is installed by the installation file, the md5sum matches what you have on your website for the installation file but NOT for WinSCP2.exe. Since the installation file matches, I am inclined to trust what it creates, but it is disconcerting to have a checksum failure on a security program.